diff --git a/.github/workflows/ghcr.yml b/.github/workflows/ghcr.yml index b992e71..cefbc19 100644 --- a/.github/workflows/ghcr.yml +++ b/.github/workflows/ghcr.yml @@ -1,11 +1,10 @@ -# Build and push container image to GHCR on main branch pushes. -# Copy this to .github/workflows/ghcr.yml in each agent repo. +# Build and push Nix-built container image to GHCR on main branch pushes. +# For repos that use `nix build .#container` instead of Dockerfile. # # Tags: # sha- — immutable, Renovate tracks these # edge — rolling latest from main branch # latest — alias for edge on main -# v* — semver release tags # # Usage: # 1. Copy to repo's .github/workflows/ghcr.yml @@ -16,13 +15,11 @@ name: GHCR Build on: push: branches: [main] - tags: ['v*'] workflow_dispatch: env: REGISTRY: ghcr.io OWNER: tinyland-inc - # Change this per repo: ironclaw, picoclaw, or hexstrike-ai REPO_NAME: hexstrike-ai permissions: @@ -37,8 +34,13 @@ jobs: - name: Checkout uses: actions/checkout@v4 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + - name: Install Nix + uses: cachix/install-nix-action@v30 + with: + nix_path: nixpkgs=channel:nixos-unstable + + - name: Build container image + run: nix build .#container --print-build-logs - name: Log in to GHCR uses: docker/login-action@v3 @@ -47,24 +49,23 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Extract metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }} - tags: | - type=sha,prefix=sha-,format=short - type=edge,branch=main - type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} - type=semver,pattern=v{{version}} + - name: Load and tag image + run: | + # Nix produces a tarball at ./result + docker load < ./result - - name: Build and push - uses: docker/build-push-action@v5 - with: - context: . - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - platforms: linux/amd64 - cache-from: type=gha - cache-to: type=gha,mode=max + # The image is tagged as defined in flake.nix (usually :edge) + SOURCE="${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:edge" + SHA_SHORT=$(echo "${{ github.sha }}" | cut -c1-7) + + # Tag with sha, edge, and latest + docker tag "$SOURCE" "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:sha-${SHA_SHORT}" + docker tag "$SOURCE" "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:edge" + docker tag "$SOURCE" "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:latest" + + - name: Push all tags + run: | + SHA_SHORT=$(echo "${{ github.sha }}" | cut -c1-7) + docker push "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:sha-${SHA_SHORT}" + docker push "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:edge" + docker push "${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:latest" diff --git a/tinyland/workspace/AGENT.md b/tinyland/workspace/AGENT.md index 0cc9116..639b4f5 100644 --- a/tinyland/workspace/AGENT.md +++ b/tinyland/workspace/AGENT.md @@ -35,18 +35,13 @@ __findings__[ ## Available Tools -### Security Tools (42 via MCP protocol) -Native tools dispatched through the Go gateway to the OCaml MCP server: -- `smart_scan` -- AI-driven scan with automatic tool selection -- `target_profile` -- multi-phase reconnaissance and profiling -- `port_scan`, `nmap_scan`, `host_discovery` -- network recon -- `tls_check` -- TLS/SSL verification -- `credential_scan`, `sops_rotation_check` -- credential auditing -- `container_scan`, `k8s_audit` -- cloud/container security -- `vuln_scan`, `sqli_test`, `xss_test` -- web security -- See TOOLS.md for the full 42-tool inventory - -### Platform Tools (via adapter sidecar) +### Security Tools (Flask API) +- `/api/command` -- execute security commands (nmap, curl, etc.) +- `/api/intelligence/smart-scan` -- AI-driven scan with automatic tool selection +- `/api/intelligence/analyze-target` -- target profiling and reconnaissance +- `/api/error-handling/execute-with-recovery` -- commands with retry/recovery + +### Platform Tools (via adapter) - `juggler_resolve_composite` -- resolve credentials from multiple sources - `juggler_setec_list` / `juggler_setec_get` / `juggler_setec_put` -- secret store - `juggler_audit_log` -- query audit trail diff --git a/tinyland/workspace/TOOLS.md b/tinyland/workspace/TOOLS.md index e3d9812..a0c4758 100644 --- a/tinyland/workspace/TOOLS.md +++ b/tinyland/workspace/TOOLS.md @@ -1,27 +1,17 @@ # HexStrike-AI Tool Reference -## Native Security Tools (42 tools via MCP) - -HexStrike-AI exposes 42 verified security tools via JSON-RPC 2.0 (MCP protocol). -The Go gateway proxies MCP requests to the OCaml server over stdio. - -| Domain | Tools | Count | -|--------|-------|-------| -| WebSecurity | dir_discovery, vuln_scan, sqli_test, xss_test, waf_detect, web_crawl | 6 | -| NetworkRecon | port_scan, host_discovery, nmap_scan, network_posture | 4 | -| Forensics | memory_forensics, file_carving, steganography, metadata_extract | 4 | -| CredentialAudit | credential_scan, sops_rotation_check, brute_force, hash_crack | 4 | -| CloudSecurity | cloud_posture, container_scan, iac_scan, k8s_audit | 4 | -| BinaryAnalysis | disassemble, debug, gadget_search, firmware_analyze | 4 | -| SMBEnum | smb_enum, network_exec, rpc_enum | 3 | -| Intelligence | cve_monitor, exploit_gen, threat_correlate | 3 | -| APITesting | api_fuzz, graphql_scan, jwt_analyze | 3 | -| Orchestration | smart_scan, target_profile | 2 | -| Meta | server_health, execute_command | 2 | -| DNSRecon | subdomain_enum, dns_recon | 2 | -| CryptoAnalysis | tls_check | 1 | - -## Platform Tools via Adapter Proxy +## Native Security Tools (Flask API on port 8888) + +HexStrike-AI exposes security tools via its Flask REST API: + +| Endpoint | Method | Description | +|----------|--------|-------------| +| `/api/command` | POST | Execute security commands (nmap, curl, etc.) | +| `/api/intelligence/smart-scan` | POST | AI-driven scan with automatic tool selection | +| `/api/intelligence/analyze-target` | POST | Target profiling and reconnaissance | +| `/api/error-handling/execute-with-recovery` | POST | Commands with retry/recovery | + +## Platform Tools via Adapter Proxy (51 total: 15 gateway + 36 Chapel) Platform tools provided by the adapter sidecar, proxied from rj-gateway. @@ -123,7 +113,7 @@ Gateway endpoint: `http://rj-gateway.fuzzy-dev.svc.cluster.local:8080/mcp` - **GitHub token**: Automatically resolved by gateway - **NET_RAW/NET_ADMIN**: Container has network capabilities for security scanning - **Rate limits**: GitHub API has rate limits. Space out bulk fetches -- **Tool timeouts**: MCP tools have per-tool timeouts (5s-600s); see Dhall schemas +- **Tool timeouts**: MCP tools have a 30s default timeout - **Scope**: Only scan tinyland-inc infrastructure and authorized targets - **Credentials**: Never store raw credentials in findings — reference by name only